The Executive by MaxwellCTI Digest: November 6, 2026

Get the full story at intel.maxwellcti.com.

Cybercriminals are using agentic AI to automate hacking, the US sanctioned Prince Group affiliates over a scam network, and a cyberattack targeted the French blood supply.

Novel techniques

Cybercriminals use agentic AI to automate secret discovery and hacking

Threat actors are using an agentic AI offensive framework called ARTEX to autonomously discover and abuse exposed secrets and vulnerabilities. This tool allows actors to scan GitHub for credentials to compromise cloud resources, steal code-signing certificates, and recover gaming account credentials. Microsoft observed an AI agent progress from scanning GitHub for secrets to exfiltrating data from Azure Key Vault in five minutes.

XLab Identifies CWPdoor Backdoor Targeting Control Web Panel cwpsrv Web Server

XLab identified a Linux backdoor called CWPdoor that targets the cwpsrv web server used by the Control Web Panel. The malware replaces the legitimate binary with a trojanized version that allows command execution via encrypted HTTP headers while suppressing access logs. XLab reported that more than 340,000 CWP instances were exposed on the public web over the past month.

Business

US Sanctions Cambodian-based Prince Group Affiliates Over Billion-Dollar Scam Network

The United States Department of the Treasury sanctioned four individuals and 41 companies linked to Prince Group, a Cambodian-based network accused of using human trafficking victims to conduct billion-dollar cyberscams. These measures aim to dismantle the leadership, corporate structures, and financial facilitators of such organizations.

Cyberattacks Target Critical Infrastructure and French Blood Supply

A cyberattack on the French Blood Establishment manipulated temperature controls in cold storage rooms for plasma used for transfusions and medications. The attack attempted to reset temperatures from -30°C to as high as 110°C. The National Cybersecurity Agency of France is coordinating preventive and remediation measures across all potentially impacted industries.

Meta, TikTok, and Google Sue California Over Kids' Safety Law

Meta, TikTok, and Google filed lawsuits to block California's Assembly Bill 1709, which prohibits social media platforms from using features described as psychologically exploitative for users aged 15 and younger. The companies argue the law is unconstitutional, violates freedom of speech, and improperly shifts decision-making from parents to the state. Google stated the law could break the systems used to help children find age-appropriate videos.

Critical vulnerabilities

• Zyxel GS1900 series switches (CVE-2026-107441, CVE-2026-7273): unauthenticated attackers can achieve OS command execution, and CVE-2026-107441 is exploited; Zyxel has released fixes.